Commit Graph

444 Commits

Author SHA1 Message Date
Artem Dergachev c531d54967 [CFG] [analyzer] Find argument constructors in CXXTemporaryObjectExprs.
CXXTemporaryObjectExpr is a sub-class of CXXConstructExpr. If it has arguments
that are structures passed by value, their respective constructors need to be
handled by providing a ConstructionContext, like for regular function calls and
for regular constructors.

Differential Revision: https://reviews.llvm.org/D50487

llvm-svn: 339727
2018-08-14 21:10:46 +00:00
Artem Dergachev 1f8cb3a65e [CFG] [analyzer] NFC: Enumerate construction context layer kinds.
This is a refactoring patch; no functional change intended.

The common part of ConstructionContextLayer and ConstructedObjectKey is
factored out into a new structure, ConstructionContextItem.

Various sub-kinds of ConstructionContextItem are enumerated in order to
provide richer information about construction contexts.

Differential Revision: https://reviews.llvm.org/D49210.

llvm-svn: 338439
2018-07-31 21:12:42 +00:00
Artem Dergachev a657a32cc8 [CFG] [analyzer] Implement function argument construction contexts.
In r330377 and r338425 we have already identified what constitutes function
argument constructors and added stubs in order to prevent confusing them
with other temporary object constructors.

Now we implement a ConstructionContext sub-class to carry all the necessary
information about the construction site, namely call expression and argument
index.

On the analyzer side, the patch interacts with the recently implemented
pre-C++17 copy elision support in an interesting manner. If on the CFG side we
didn't find a construction context for the elidable constructor, we build
the CFG as if the elidable constructor is not elided, and the non-elided
constructor within it is a simple temporary. But the same problem may occur
in the analyzer: if the elidable constructor has a construction context but
the analyzer doesn't implement such context yet, the analyzer should also
try to skip copy elision and still inline the non-elided temporary constructor.
This was implemented by adding a "roll back" mechanism: when elision fails,
roll back the changes and proceed as if it's a simple temporary. The approach
is wonky, but i'm fine with that as long as it's merely a defensive mechanism
that should eventually go away once all construction contexts become supported.

Differential Revision: https://reviews.llvm.org/D48681.

llvm-svn: 338436
2018-07-31 20:45:53 +00:00
Artem Dergachev e1f3062100 [CFG] [analyzer] Add construction contexts for returning C++ objects in ObjC++.
Like any normal funciton, Objective-C message can return a C++ object
in Objective-C++. Such object would require a construction context.

This patch, therefore, is an extension of r327343 onto Objective-C++.

Differential Revision: https://reviews.llvm.org/D48608

llvm-svn: 338426
2018-07-31 19:46:14 +00:00
Artem Dergachev bd880fe1c1 [CFG] [analyzer] Add stubs for constructor and message argument constructors.
CFG now correctly identifies construction context for temporaries constructed
for the purpose of passing into a function as an argument.

Such context is still not fully implemented because the information it provides
is not rich enough: it doens't contain information about argument index.
It will be addresssed later.

This patch is an extension of r330377 to C++ construct-expressions and
Objective-C message expressions which aren't call-expressions but require
similar handling. C++ new-expressions with placement arguments still remain to
be handled.

Differential Revision: https://reviews.llvm.org/D49826

llvm-svn: 338425
2018-07-31 19:39:37 +00:00
Fangrui Song 6907ce2f8f Remove trailing space
sed -Ei 's/[[:space:]]+$//' include/**/*.{def,h,td} lib/**/*.{cpp,h}

llvm-svn: 338291
2018-07-30 19:24:48 +00:00
Richard Smith 7ed5fb2d22 Add missing temporary materialization conversion on left-hand side of .
in some member function calls.

Specifically, when calling a conversion function, we would fail to
create the AST node representing materialization of the class object.

llvm-svn: 338135
2018-07-27 17:13:18 +00:00
Artem Dergachev 8ac6c9dd67 [CFG] [analyzer] Allow elidable copies to have more than one arguments.
Copy-constructors and move-constructors may have default arguments. It is
incorrect to assert that they only have one argument, i.e. the reference to the
object being copied or moved. Remove the assertion.

Differential Revision: https://reviews.llvm.org/D49215

llvm-svn: 337229
2018-07-17 00:57:57 +00:00
Artem Dergachev ff267df0de [CFG] [analyzer] Add construction contexts that explain pre-C++17 copy elision.
Before C++17 copy elision was optional, even if the elidable copy/move
constructor had arbitrary side effects. The elidable constructor is present
in the AST, but marked as elidable.

In these cases CFG now contains additional information that allows its clients
to figure out if a temporary object is only being constructed so that to pass
it to an elidable constructor. If so, it includes a reference to the elidable
constructor's construction context, so that the client could elide the
elidable constructor and construct the object directly at its final destination.

Differential Revision: https://reviews.llvm.org/D47616

llvm-svn: 335795
2018-06-28 00:04:54 +00:00
Artem Dergachev a25809fb74 [CFG] Fix automatic destructors when a member is bound to a reference.
In code like

    const int &x = A().x;

automatic destructor for the object A() lifetime-extended by reference 'x' was
not present in the clang CFG due to ad-hoc pattern-matching in
getReferenceInitTemporaryType().

Re-use skipRValueSubobjectAdjustments() again to find the lifetime-extended
object in the AST and emit the correct destructor.

Lifetime extension through aggregates with references still needs to be covered.

Differential Revision: https://reviews.llvm.org/D44238

llvm-svn: 333941
2018-06-04 18:56:25 +00:00
Adrian Prantl 9fc8faf9e6 Remove \brief commands from doxygen comments.
This is similar to the LLVM change https://reviews.llvm.org/D46290.

We've been running doxygen with the autobrief option for a couple of
years now. This makes the \brief markers into our comments
redundant. Since they are a visual distraction and we don't want to
encourage more \brief markers in new code either, this patch removes
them all.

Patch produced by

for i in $(git grep -l '\@brief'); do perl -pi -e 's/\@brief //g' $i & done
for i in $(git grep -l '\\brief'); do perl -pi -e 's/\\brief //g' $i & done

Differential Revision: https://reviews.llvm.org/D46320

llvm-svn: 331834
2018-05-09 01:00:01 +00:00
Richard Smith eaf11ad709 Track the result of evaluating a computed noexcept specification on the
FunctionProtoType.

We previously re-evaluated the expression each time we wanted to know whether
the type is noexcept or not. We now evaluate the expression exactly once.

This is not quite "no functional change": it fixes a crasher bug during AST
deserialization where we would try to evaluate the noexcept specification in a
situation where we have not deserialized sufficient portions of the AST to
permit such evaluation.

llvm-svn: 331428
2018-05-03 03:58:32 +00:00
Artem Dergachev ab9b78b200 [CFG] [analyzer] Add construction contexts for loop condition variables.
Loop condition variables, eg.

  while (shared_ptr<int> P = getIntPtr()) { ... })

weren't handled in r324794 because they don't go through the common
CFGBuilder::VisitDeclStmt method. Which means that they regressed
after r324800.

Fix the regression by duplicating the necessary construction context scan in
the loop visiting code.

Differential Revision: https://reviews.llvm.org/D45706

llvm-svn: 330382
2018-04-19 23:30:15 +00:00
Artem Dergachev 72da02fc30 [CFG] [analyzer] Don't treat argument constructors as temporary constructors.
Function argument constructors (that are used for passing objects into functions
by value) are completely unlike temporary object constructors, but we were
treating them as such because they are also wrapped into a CXXBindTemporaryExpr.

This patch adds a partial construction context layer for call argument values,
but doesn't proceed to transform it into an actual construction context yet.
This is tells the clients that we aren't supporting these constructors yet.

Differential Revision: https://reviews.llvm.org/D45650

llvm-svn: 330377
2018-04-19 23:09:22 +00:00
Artem Dergachev 6a5cd5e1ca [CFG] [analyzer] Work around a disappearing CXXBindTemporaryExpr.
Sometimes template instantiation causes CXXBindTemporaryExpr to be missing in
its usual spot. In CFG, temporary destructors work by relying on
CXXBindTemporaryExprs, so they won't work in this case.

Avoid the crash and notify the clients that we've encountered an unsupported AST
by failing to provide the ill-formed construction context for the temporary.

Differential Revision: https://reviews.llvm.org/D44955

llvm-svn: 328895
2018-03-30 19:25:39 +00:00
Artem Dergachev 9d3a7d8b2b [CFG] [analyzer] Avoid modeling C++17 constructors that aren't fully supported.
Not enough work has been done so far to ensure correctness of construction
contexts in the CFG when C++17 copy elision is in effect, so for now we
should drop construction contexts in the CFG and in the analyzer when
they seem different from what we support anyway.

This includes initializations with conditional operators and return values
across multiple stack frames.

Differential Revision: https://reviews.llvm.org/D44854

llvm-svn: 328893
2018-03-30 19:21:18 +00:00
Artem Dergachev 922455fe62 [CFG] [analyzer] Add C++17-specific ctor-initializer construction contexts.
CXXCtorInitializer-based constructors are also affected by the C++17 mandatory
copy elision, like variable constructors and return value constructors.
Extend r328248 to support those.

Differential Revision: https://reviews.llvm.org/D44763

llvm-svn: 328255
2018-03-22 22:02:38 +00:00
Artem Dergachev 317291e340 [CFG] [analyzer] Add C++17-specific variable and return construction contexts.
In C++17 copy elision is mandatory for variable and return value constructors
(as long as it doesn't involve type conversion) which results in AST that does
not contain elidable constructors in their usual places. In order to provide
construction contexts in this scenario we need to cover more AST patterns.

This patch makes the CFG prepared for these scenarios by:

- Fork VariableConstructionContext and ReturnedValueConstructionContext into
  two different sub-classes (each) one of which indicates the C++17 case and
  contains a reference to an extra CXXBindTemporaryExpr.
- Allow CFGCXXRecordTypedCall element to accept VariableConstructionContext and
  ReturnedValueConstructionContext as its context.

Differential Revision: https://reviews.llvm.org/D44597

llvm-svn: 328248
2018-03-22 21:37:39 +00:00
Richard Trieu f4a0e9a78c [CFG] Allow CallExpr's to be looked up in CFG's
r327343 changed the handling for CallExpr in a CFG, which prevented lookups for
CallExpr while other Stmt kinds still worked.  This change carries over the
necessary bits from Stmt function to CallExpr function.

llvm-svn: 327593
2018-03-15 00:09:26 +00:00
Artem Dergachev 54ed6428b4 [CFG] [analyzer] Don't add construction context to a return-by-reference call.
Call expressions that return objects by an lvalue reference or an rvalue
reference have a value type in the AST but wear an auxiliary flag of being an
lvalue or an xvalue respectively.

Use the helper method for obtaining the actual return type of the function.

Fixes a crash.

Differential Revision: https://reviews.llvm.org/D44273

llvm-svn: 327352
2018-03-12 23:52:36 +00:00
Artem Dergachev 1527dec139 [CFG] [analyzer] Add construction context to C++ return-by-value call elements.
This patch adds a new CFGStmt sub-class, CFGCXXRecordTypedCall, which replaces
the regular CFGStmt for the respective CallExpr whenever the CFG has additional
information to provide regarding the lifetime of the returned value.

This additional call site information is represented by a ConstructionContext
(which was previously used for CFGConstructor elements) that provides references
to CXXBindTemporaryExpr and MaterializeTemporaryExpr that surround the call.

This corresponds to the common C++ calling convention solution of providing
the target address for constructing the return value as an auxiliary implicit
argument during function call.

One of the use cases for such extra context at the call site would be to perform
any sort of inter-procedural analysis over the CFG that involves functions
returning objects by value. In this case the elidable constructor at the return
site would construct the object explained by the context at the call site, and
its lifetime would also be managed by the caller, not the callee.

The extra context would also be useful for properly handling the return-value
temporary at the call site, even if the callee is not being analyzed
inter-procedurally.

Differential Revision: https://reviews.llvm.org/D44120

llvm-svn: 327343
2018-03-12 23:12:40 +00:00
Maxim Ostapenko debca45e45 [analyzer] Add scope information to CFG
This patch adds two new CFG elements CFGScopeBegin and CFGScopeEnd that indicate
when a local scope begins and ends respectively. We use first VarDecl declared
in a scope to uniquely identify it and add CFGScopeBegin and CFGScopeEnd elements
into corresponding basic blocks.

Differential Revision: https://reviews.llvm.org/D16403

llvm-svn: 327258
2018-03-12 12:26:15 +00:00
Artem Dergachev 13f9664d2b [CFG] [analyzer] Add construction context for implicit constructor conversions.
Implicit constructor conversions such as A a = B() are represented by
surrounding the constructor for B() with an ImplicitCastExpr of
CK_ConstructorConversion kind, similarly to how explicit constructor conversions
are surrounded by a CXXFunctionalCastExpr. Support this syntax pattern when
extracting the construction context for the implicit constructor that
performs the conversion.

Differential Revision: https://reviews.llvm.org/D44051

llvm-svn: 327096
2018-03-09 01:39:59 +00:00
George Burgess IV a47e1b7304 Fix an unused variable warning; NFC
llvm-svn: 326767
2018-03-06 07:45:11 +00:00
Artem Dergachev 6603052235 [CFG] [analyzer] Recall that we only skip NoOp casts in construction contexts.
For now. We should also add support for ConstructorConversion casts as presented
in the attached test case, but this requires more changes because AST around
them seems different.

The check was originally present but was accidentally lost during r326021.

Differential Revision: https://reviews.llvm.org/D43840

llvm-svn: 326402
2018-03-01 01:09:24 +00:00
Artem Dergachev 4068481bdb [CFG] NFC: Refactor ConstructionContext into a finite set of cases.
ConstructionContext is moved into a separate translation unit and is separated
into multiple classes. The "old" "raw" ConstructionContext is renamed into
ConstructionContextLayer - which corresponds to the idea of building the context
gradually layer-by-layer, but it isn't easy to use in the clients. Once
CXXConstructExpr is reached, layers that we've gathered so far are transformed
into the actual, "new-style" "flat" ConstructionContext, which is put into the
CFGConstructor element and has no layers whatsoever (until it actually needs
them, eg. aggregate initialization). The new-style ConstructionContext is
instead presented as a variety of sub-classes that enumerate different ways of
constructing an object in C++. There are 5 of these supported for now,
which is around a half of what needs to be supported.

The layer-by-layer buildup process is still a little bit weird, but it hides
all the weirdness in one place, that sounds like a good thing.

Differential Revision: https://reviews.llvm.org/D43533

llvm-svn: 326238
2018-02-27 20:03:35 +00:00
Artem Dergachev 1c6ed3add6 [CFG] Keep speculatively working around an MSVC compiler crash.
Replace if() with a switch(). Because random changes in the code seem to
suppress the crash.

Story so far:
r325966 - Crash introduced.
r325969 - Speculative fix had no effect.
r325978 - Tried to bisect the offending function, crash suddenly disappeared.
r326016 - After another random change in the code, bug appeared again.

llvm-svn: 326021
2018-02-24 03:54:22 +00:00
Artem Dergachev a6d91d5b30 [CFG] Provide construction contexts for temporaries in conditional operators.
When a lifetime-extended temporary is on a branch of a conditional operator,
materialization of such temporary occurs after the condition is resolved.

This change allows us to understand, by including the MaterializeTemporaryExpr
in the construction context, the target for temporary materialization in such
cases.

Differential Revision: https://reviews.llvm.org/D43483

llvm-svn: 326019
2018-02-24 03:10:15 +00:00
Artem Dergachev 8cc55e9f16 [CFG] Provide construction contexts for temporaries bound to const references.
In order to bind a temporary to a const lvalue reference, a no-op cast is added
to make the temporary itself const, and only then the reference is taken
(materialized). Skip the no-op cast when looking for the construction context.

Differential Revision: https://reviews.llvm.org/D43481

llvm-svn: 326016
2018-02-24 02:07:50 +00:00
Artem Dergachev ceb7d91a48 [CFG] Provide construction contexts for functional cast-like constructors.
When a constructor of a temporary with a single argument is treated
as a functional cast expression, skip the functional cast expression
and provide the correct construction context for the temporary.

Differential Revision: https://reviews.llvm.org/D43480

llvm-svn: 326015
2018-02-24 02:05:11 +00:00
Artem Dergachev f43ac4c9ac [CFG] Provide construction contexts for lifetime-extended temporaries.
When constructing a temporary that is going to be lifetime-extended through a
MaterializeTemporaryExpr later, CFG elements for the respective constructor
can now be queried to obtain the reference to that MaterializeTemporaryExpr
and therefore gain information about lifetime extension.

This may produce multi-layered construction contexts when information about
both temporary destruction and lifetime extension is available.

Differential Revision: https://reviews.llvm.org/D43477

llvm-svn: 326014
2018-02-24 02:00:30 +00:00
Artem Dergachev c1b07bdde9 [CFG] Try to narrow down MSVC compiler crash via binary search.
Split the presumably offending function in two to see which part of it causes
the crash to occur.

The crash was introduced in r325966.
r325969 did not help.

llvm-svn: 325978
2018-02-23 23:38:41 +00:00
Artem Dergachev 5e2f6ba51e [CFG] NFC: Speculative attempt to fix MSVC internal compiler error on buildbot.
Don't use fancy initialization and member access in a DenseMap.

llvm-svn: 325969
2018-02-23 22:49:25 +00:00
Artem Dergachev 783a4578c1 [CFG] [analyzer] NFC: Allow more complicated construction contexts.
ConstructionContexts introduced in D42672 are an additional piece of information
included with CFGConstructor elements that help the client of the CFG (such as
the Static Analyzer) understand where the newly constructed object is stored.

The patch refactors the ConstructionContext class to prepare for including
multi-layered contexts that are being constructed gradually, layer-by-layer,
as the AST is traversed.

Differential Revision: https://reviews.llvm.org/D43428

llvm-svn: 325966
2018-02-23 22:20:39 +00:00
Artem Dergachev 1f68d9d39e [CFG] Provide construction contexts for temproary objects.
Constructors of C++ temporary objects that have destructors now can be queried
to discover that they're indeed constructing temporary objects.

The respective CXXBindTemporaryExpr, which is also repsonsible for destroying
the temporary at the end of full-expression, is now available at the
construction site in the CFG. This is all the context we need to provide for
temporary objects that are not lifetime extended. For lifetime-extended
temporaries, more context is necessary.

Differential Revision: https://reviews.llvm.org/D43056

llvm-svn: 325210
2018-02-15 03:13:36 +00:00
Nico Weber 758fbacea5 Teach Wreturn-type, Wunreachable-code, and alpha.deadcode.UnreachableCode to treat __assume(0) like __builtin_unreachable.
Fixes PR29134.
https://reviews.llvm.org/D43221

llvm-svn: 325052
2018-02-13 21:31:47 +00:00
Artem Dergachev 9ac2e11385 [CFG] Provide construction contexts for return value constructors.
When the current function returns a C++ object by value, CFG elements for
constructors that construct the return values can now be queried to discover
that they're indeed participating in construction of the respective return value
at the respective return statement.

Differential Revision: https://reviews.llvm.org/D42875

llvm-svn: 324952
2018-02-12 22:36:36 +00:00
Artem Dergachev 08225bbed4 [CFG] Provide construction contexts when constructors have cleanups.
Now that we make it possible to query the CFG constructor element to find
information about the construction site, possible cleanup work represented by
ExprWithCleanups should not prevent us from providing this information.

This allows us to have a correct construction context for variables initialized
"by value" via elidable copy-constructors, such as 'i' in

  iterator i = vector.begin();

Differential Revision: https://reviews.llvm.org/D42719

llvm-svn: 324798
2018-02-10 02:46:14 +00:00
Artem Dergachev 5a281bba40 [CFG] Add construction context for constructor initializers.
CFG elements for constructors of fields and base classes that are being
initialized before the body of the whole-class constructor starts can now be
queried to discover that they're indeed participating in initialization of their
respective fields or bases before the whole-class constructor kicks in.

CFG construction contexts are now capable of representing CXXCtorInitializer
triggers, which aren't considered to be statements in the Clang AST.

Differential Revision: https://reviews.llvm.org/D42700

llvm-svn: 324796
2018-02-10 02:18:04 +00:00
Artem Dergachev 5fc10337a2 [CFG] Add construction context for simple variable declarations.
Constructors of simple variables now can be queried to discover that they're
constructing into simple variables.

Differential Revision: https://reviews.llvm.org/D42699

llvm-svn: 324794
2018-02-10 01:55:23 +00:00
Artem Dergachev 675d6f4df2 [CFG] Squash an unused variable introduced in r324668.
Found by -Werror buildbot.

llvm-svn: 324697
2018-02-09 01:43:26 +00:00
Artem Dergachev 41ffb30716 [CFG] Add extra context to C++ constructor statement elements.
This patch adds a new CFGStmt sub-class, CFGConstructor, which replaces
the regular CFGStmt with CXXConstructExpr in it whenever the CFG has additional
information to provide regarding what sort of object is being constructed.

It is useful for figuring out what memory is initialized in client of the
CFG such as the Static Analyzer, which do not operate by recursive AST
traversal, but instead rely on the CFG to provide all the information when they
need it. Otherwise, the statement that triggers the construction and defines
what memory is being initialized would normally occur after the
construct-expression, and the client would need to peek to the next CFG element
or use statement parent map to understand the necessary facts about
the construct-expression.

As a proof of concept, CFGConstructors are added for new-expressions
and the respective test cases are provided to demonstrate how it works.

For now, the only additional data contained in the CFGConstructor element is
the "trigger statement", such as new-expression, which is the parent of the
constructor. It will be significantly expanded in later commits. The additional
data is organized as an auxiliary structure - the "construction context",
which is allocated separately from the CFGElement.

Differential Revision: https://reviews.llvm.org/D42672

llvm-svn: 324668
2018-02-08 22:58:15 +00:00
Eugene Zelenko 38c70521ff [Analysis] Fix some Clang-tidy modernize and Include What You Use warnings; other minor fixes (NFC).
llvm-svn: 320091
2017-12-07 21:55:09 +00:00
Aleksei Sidorin 124f5de841 [Analyzer] Stable iteration on indirect goto LabelDecl's to avoid non-determinism (attempt 2)
CFG wass built in non-deterministic order due to the fact that indirect
goto labels' declarations (LabelDecl's) are stored in the llvm::SmallSet
container. LabelDecl's are pointers, whose order is not deterministic,
and llvm::SmallSet sorts them by their non-deterministic addresses after
"small" container is exceeded. This leads to non-deterministic processing
of the elements of the container.

The fix is to use llvm::SmallSetVector that was designed to have
deterministic iteration order.

Patch by Ilya Palachev!

Differential Revision: https://reviews.llvm.org/D40073

llvm-svn: 318754
2017-11-21 11:27:47 +00:00
Nico Weber 699670e764 Implement CFG construction for __try / __except / __leave.
This makes -Wunreachable-code work for programs containing SEH (except for
__finally, which is still missing for now).

__try is modeled like try (but simpler since it can only have a single __except
or __finally), __except is fairly similar to catch (but simpler, since it can't
contain declarations). __leave is implemented similarly to break / continue.

Use the existing addTryDispatchBlock infrastructure (which
FindUnreachableCode() in ReachableCode.cpp uses via cfg->try_blocks_begin()) to
mark things in the __except blocks as reachable.

Re-use TryTerminatedBlock. This means we add EH edges from calls to the __try
block, but not from all other statements. While this is incomplete, it matches
LLVM's SEH codegen support. Also, in practice, BuildOpts.AddEHEdges is always
false in practice from what I can tell, so we never even insert the call EH
edges either.

https://reviews.llvm.org/D36914

llvm-svn: 311561
2017-08-23 15:33:16 +00:00
Peter Szecsi 999a25ff72 [CFG] Add LoopExit information to CFG
This patch introduces a new CFG element CFGLoopExit that indicate when a loop
ends. It does not deal with returnStmts yet (left it as a TODO).
It hidden behind a new analyzer-config flag called cfg-loopexit (false by
default).
Test cases added.

The main purpose of this patch right know is to make loop unrolling and loop
widening easier and more efficient. However, this information can be useful for
future improvements in the StaticAnalyzer core too.

Differential Revision: https://reviews.llvm.org/D35668

llvm-svn: 311235
2017-08-19 11:19:16 +00:00
Matthias Gehre 351c218d15 CFG: Add CFGElement for automatic variables that leave the scope
Summary:
This mimics the implementation for the implicit destructors. The
generation of this scope leaving elements is hidden behind
a flag to the CFGBuilder, thus it should not affect existing code.

Currently, I'm missing a test (it's implicitly tested by the clang-tidy
lifetime checker that I'm proposing).
I though about a test using debug.DumpCFG, but then I would
have to add an option to StaticAnalyzer/Core/AnalyzerOptions
to enable the scope leaving CFGElement,
which would only be useful to that particular test.

Any other ideas how I could make a test for this feature?

Reviewers: krememek, jordan_rose

Subscribers: cfe-commits

Differential Revision: http://reviews.llvm.org/D15031

llvm-svn: 307759
2017-07-12 07:04:19 +00:00
Martin Bohme 0c11c29121 [analyzer] Fix crash when building CFG with variable of incomplete type
Summary:
I've included a unit test with a function template containing a variable
of incomplete type. Clang compiles this without errors (the standard
does not require a diagnostic in this case). Without the fix, this case
triggers the crash.

Reviewers: klimek

Reviewed By: klimek

Subscribers: cfe-commits

Differential Revision: https://reviews.llvm.org/D30636

llvm-svn: 297129
2017-03-07 08:42:37 +00:00
Richard Smith 509bbd1a66 PR31631: fix bad CFG (and bogus warnings) when an if-statement has an init-statement and has binary operator as its condition.
llvm-svn: 291964
2017-01-13 22:16:41 +00:00
Richard Trieu 6a6af52ba6 Extend -Wtautological-overlap-compare to more cases.
Previously, -Wtautological-overlap-compare did not warn on cases where the
boolean expression was in an assignment or return statement.  This patch
should cause all boolean statements to be passed to the tautological compare
checks in the CFG analysis.

This is one of the issues from PR13101

llvm-svn: 290920
2017-01-04 00:46:30 +00:00
Richard Smith b8c0f553ed DR1295 and cleanup for P0135R1: Make our initialization code more directly
mirror the description in the standard. Per DR1295, this means that binding a
const / rvalue reference to a bit-field no longer "binds directly", and per
P0135R1, this means that we materialize a temporary in reference binding
after adjusting cv-qualifiers and before performing a derived-to-base cast.

In C++11 onwards, this should have fixed the last case where we would
materialize a temporary of the wrong type (with a subobject adjustment inside
the MaterializeTemporaryExpr instead of outside), but we still have to deal
with that possibility in C++98, unless we want to start using xvalues to
represent materialized temporaries there too.

llvm-svn: 289250
2016-12-09 18:49:13 +00:00
Martin Bohme f44cde8b73 CFGBuilder: Fix crash when visiting delete expression on dependent type
Summary:
CXXDeleteExpr::getDestroyedType() can return a null QualType if the destroyed
type is a dependent type. This patch protects against this.

Reviewers: klimek

Subscribers: cfe-commits

Differential Revision: https://reviews.llvm.org/D27350

llvm-svn: 288665
2016-12-05 11:33:19 +00:00
Benjamin Kramer c3f89253ae Retire llvm::alignOf in favor of C++11 alignof.
No functionality change intended.

llvm-svn: 284730
2016-10-20 14:27:22 +00:00
Daniel Marjamaki 042a3c5a2d [StaticAnalyzer] Fix UnreachableCode false positives.
When there is 'do { } while (0);' in the code the ExplodedGraph and UnoptimizedCFG did not match.

Differential Revision: https://reviews.llvm.org/D24759

llvm-svn: 283095
2016-10-03 08:28:51 +00:00
Devin Coughlin 6eb1ca7416 [CFG] Fix crash finding destructor of lifetime-extended temporary.
Fix a crash under -Wthread-safety when finding the destructor for a
lifetime-extending reference.

A patch by Nandor Licker!

Differential Revision: https://reviews.llvm.org/D22419

llvm-svn: 277522
2016-08-02 21:07:23 +00:00
Richard Smith a547eb27fa P0305R0: Semantic analysis and code generation for C++17 init-statement for 'if' and 'switch':
if (stmt; condition) { ... }

Patch by Anton Bikineev! Some minor formatting and comment tweets by me.

llvm-svn: 275350
2016-07-14 00:11:03 +00:00
Alexander Kornienko ff2046a93e CFGBuilder: Fix crash when visiting a range-based for over a dependent type
Summary:
CFG generation is expected to fail in this case, but it should not crash.

Also added a test that reproduces the crash.

Reviewers: klimek

Subscribers: cfe-commits

Patch by Martin Boehme!

Differential Revision: http://reviews.llvm.org/D21895

llvm-svn: 274834
2016-07-08 10:50:51 +00:00
Benjamin Kramer 2e018efa9b Turn copies into references as suggested by clang-tidy's performance-unnecessary-copy-initialization.
llvm-svn: 270994
2016-05-27 13:36:58 +00:00
Richard Smith 01694c340d P0184R0: Allow types of 'begin' and 'end' expressions in range-based for loops to differ.
llvm-svn: 263895
2016-03-20 10:33:40 +00:00
Yaron Keren cdae941e03 Annotate dump() methods with LLVM_DUMP_METHOD, addressing Richard Smith r259192 post commit comment.
llvm-svn: 259232
2016-01-29 19:38:18 +00:00
Craig Topper 9b2438f6d1 Use range-based for loop to avoid the need for calculating an array size. NFC
llvm-svn: 254282
2015-11-30 03:11:12 +00:00
Devin Coughlin b6029b7ef4 [analyzer] Include block capture copy expressions in the CFG.
This prevents spurious dead store warnings when a C++ lambda is casted to a block.

I've also added several tests documenting our still-incomplete support for lambda-to-block
casts.

rdar://problem/22236293

llvm-svn: 254107
2015-11-25 22:35:37 +00:00
Matthias Gehre 09a134eca3 CFG: Delay creating Dtors for CompoundStmts which end in ReturnStmt
Summary:
VisitReturnStmt would create a new block with including Dtors, so the Dtors created
in VisitCompoundStmts would be in an unreachable block.

Example:

struct S {
  ~S();
};

void f()
{
  S s;
  return;
}

void g()
{
  S s;
}

Before this patch, f has one additional unreachable block containing just the
destructor of S. With this patch, both f and g have the same blocks.

Reviewers: krememek

Subscribers: cfe-commits

Differential Revision: http://reviews.llvm.org/D13973

llvm-svn: 253107
2015-11-14 00:36:50 +00:00
Angel Garcia Gomez 637d1e6694 Roll-back r250822.
Summary: It breaks the build for the ASTMatchers

Subscribers: klimek, cfe-commits

Differential Revision: http://reviews.llvm.org/D13893

llvm-svn: 250827
2015-10-20 13:23:58 +00:00
Angel Garcia Gomez b5250d3448 Apply modernize-use-default to clang.
Summary: Replace empty bodies of default constructors and destructors with '= default'.

Reviewers: bkramer, klimek

Subscribers: klimek, alexfh, cfe-commits

Differential Revision: http://reviews.llvm.org/D13890

llvm-svn: 250822
2015-10-20 12:52:55 +00:00
George Burgess IV ced56e6eca Teach -Wtautological-overlap-compare about enums
Prior to this patch, -Wtautological-overlap-compare would only warn us
if there was a sketchy logical comparison between variables and
IntegerLiterals. This patch makes -Wtautological-overlap-compare aware
of EnumConstantDecls, so it can apply the same logic to them.

llvm-svn: 249053
2015-10-01 18:47:52 +00:00
Devin Coughlin eb538abfbd [analyzer] Create one state for a range switch case instead of multiple.
This fixes PR16833, in which the analyzer was using large amounts of memory
for switch statements with large case ranges.

rdar://problem/14685772

A patch by Aleksei Sidorin!

Differential Revision: http://reviews.llvm.org/D5102

llvm-svn: 248318
2015-09-22 20:31:19 +00:00
David Blaikie c1334cc17d Wdeprecated: Make BumpVectorContext movable
Turns out the one place that relied on the implicit copy ctor was safe
because it created an object in a state where the dtor was a no-op, but
that's more luck that good management.

Sure up the API by defining move construction and using it, which
implicitly disallows the unreliable copy operations.

llvm-svn: 244968
2015-08-13 22:12:21 +00:00
Pete Cooper 57d3f14502 Use llvm::reverse to make a bunch of loops use foreach. NFC.
In llvm commit r243581, a reverse range adapter was added which allows
us to change code such as

  for (auto I = Fields.rbegin(), E = Fields.rend(); I != E; ++I) {

in to

  for (const FieldDecl *I : llvm::reverse(Fields))

This commit changes a few of the places in clang which are eligible to use
this new adapter.

llvm-svn: 243663
2015-07-30 17:22:52 +00:00
Jonathan Roelofs ab046c5232 Analysis: Fix example usage comment in CFG.cpp. NFC
Patch by Vedant Kumar!

llvm-svn: 243275
2015-07-27 16:05:36 +00:00
Benjamin Kramer 5733e3512b [AST] Remove StmtRange in favor of an iterator_range.
StmtRange was just a convenient wrapper for two StmtIterators before
we had real range support. This removes some of the implicit conversions
StmtRange had leading to slightly more verbose code but also should make
more obvious what's going on. No functional change intended.

llvm-svn: 242615
2015-07-18 17:09:36 +00:00
Benjamin Kramer 642f173ae9 Switch users of the 'for (StmtRange range = stmt->children(); range; ++range)‘ pattern to range for loops.
The pattern was born out of the lack of range-based for loops in C++98
and is somewhat obscure. No functionality change intended.

llvm-svn: 241300
2015-07-02 21:03:14 +00:00
Eric Christopher 2c4555ad1b Fix "the the" in comments/documentation/etc.
llvm-svn: 240110
2015-06-19 01:52:53 +00:00
Enrico Pertoso faed801f6e Append CXXDefaultInitExpr's wrapped expression to the CFG when visiting a constructor initializer
Summary:
This patch is part of http://llvm-reviews.chandlerc.com/D2181.

In-class initializers are appended to the CFG when CFGBuilder::addInitializer is called.

Reviewers: jordan_rose, rsmith

Reviewed By: jordan_rose

Subscribers: cfe-commits, klimek

Differential Revision: http://reviews.llvm.org/D2370

llvm-svn: 238913
2015-06-03 10:12:40 +00:00
Richard Trieu 95a192a3ab Update -Winvalid-noreturn to handle destructors better.
When checking if a function is noreturn, consider a codepath to be noreturn if
the path destroys a class and the class destructor, base class destructors, or
member field destructors are marked noreturn.

Differential Revision: http://reviews.llvm.org/D9454

llvm-svn: 238382
2015-05-28 00:14:02 +00:00
Jonathan Roelofs 99bdd98a2b Fix 'CFG graph' typo. NFC
Patch by Jon Eyolfson!

llvm-svn: 237713
2015-05-19 18:51:56 +00:00
Alexander Kornienko 34eb20725d Use 'override/final' instead of 'virtual' for overridden methods
Summary:
The patch is generated using clang-tidy misc-use-override check.

This command was used:

  tools/clang/tools/extra/clang-tidy/tool/run-clang-tidy.py \
    -checks='-*,misc-use-override' -header-filter='llvm|clang' -j=32 -fix

Reviewers: dblaikie

Reviewed By: dblaikie

Subscribers: klimek, cfe-commits

Differential Revision: http://reviews.llvm.org/D8926

llvm-svn: 234678
2015-04-11 02:00:23 +00:00
David Blaikie 7a3cbb2997 Simplify boolean expressions in clang with clang-tidy
Patch by Richard (legalize at xmission dot com).

Differential Revision: http://reviews.llvm.org/D8155

llvm-svn: 231619
2015-03-09 02:02:07 +00:00
Aaron Ballman 673476684e Removing LLVM_EXPLICIT, as MSVC 2012 was the last reason for requiring the macro. NFC; Clang edition.
llvm-svn: 229336
2015-02-15 22:00:28 +00:00
David Blaikie e90195c09b unique_ptrify the result of CFG::buildCFG/CFGBuilder::buildCFG
llvm-svn: 216755
2014-08-29 18:53:26 +00:00
NAKAMURA Takumi 6b0fe34cc5 clangAnalysis: Avoid member initializers in TempDtorContext to appease msc17.
llvm-svn: 215193
2014-08-08 09:51:07 +00:00
Manuel Klimek deb0262a5e Fix branch reachabiliy annotation for temp dtor branches.
As we only create temp dtor decision branches when a temp dtor needs to
be run (as opposed to for each logical branch in the original
expression), we must include the information about all previous logical
branches when we annotate the temp dtor decision branch.

llvm-svn: 215188
2014-08-08 07:37:13 +00:00
Manuel Klimek edf925b935 Mark successors as reachable/unreachable instead of changing the CFG.
As suggested by Ted, this makes a few warnings less aggressive.

llvm-svn: 215128
2014-08-07 18:44:19 +00:00
Manuel Klimek cadc603e91 Fix CFG for temporary dtors when the branch taken is known.
Use the parent context when visiting temporaries when we do not insert a
temporary dtor decision branch.

llvm-svn: 215120
2014-08-07 17:02:21 +00:00
Manuel Klimek 7c03013c8b Model temporary destructors from logical operators with known values.
If the truth value of a LHS is known, we can build the knowledge whether
a temporary destructor is executed or not into the CFG. This is needed
by the return type analysis.

llvm-svn: 215118
2014-08-07 16:05:51 +00:00
Manuel Klimek 0ce9108104 Only have one path in the CFG for ternaries if the condition is known.
The return type analysis requires that the CFG is simplified when the
truth values of branches are statically known at analysis time.

llvm-svn: 215114
2014-08-07 14:25:43 +00:00
Manuel Klimek b5616c9f8d Re-applying r214962.
Changes to the original patch:
- model the CFG for temporary destructors in conditional operators so that
  the destructors of the true and false branch are always exclusive. This
  is necessary because we must not have impossible paths for the path
  based analysis to work.
- add multiple regression tests with ternary operators

Original description:
Fix modelling of non-lifetime-extended temporary destructors in the
analyzer.

Changes to the CFG:
When creating the CFG for temporary destructors, we create a structure
that mirrors the branch structure of the conditionally executed
temporary constructors in a full expression.
The branches we create use a CXXBindTemporaryExpr as terminator which
corresponds to the temporary constructor which must have been executed
to enter the destruction branch.

2. Changes to the Analyzer:
When we visit a CXXBindTemporaryExpr we mark the CXXBindTemporaryExpr as
executed in the state; when we reach a branch that contains the
corresponding CXXBindTemporaryExpr as terminator, we branch out
depending on whether the corresponding CXXBindTemporaryExpr was marked
as executed.

llvm-svn: 215096
2014-08-07 10:42:17 +00:00
Rui Ueyama a89f9c8fdb Revert "Fix modelling of non-lifetime-extended temporary destructors in the analyzer."
This reverts commit r214962 because after the change the
following code doesn't compile with -Wreturn-type -Werror.

  #include <cstdlib>

  class NoReturn {
  public:
    ~NoReturn() __attribute__((noreturn)) { exit(1); }
  };

  int check() {
    true ? NoReturn() : NoReturn();
  }

llvm-svn: 214998
2014-08-06 22:01:54 +00:00
Manuel Klimek d9b4ad6e1f Fix modelling of non-lifetime-extended temporary destructors in the analyzer.
1. Changes to the CFG:
When creating the CFG for temporary destructors, we create a structure
that mirrors the branch structure of the conditionally executed
temporary constructors in a full expression.
The branches we create use a CXXBindTemporaryExpr as terminator which
corresponds to the temporary constructor which must have been executed
to enter the destruction branch.

2. Changes to the Analyzer:
When we visit a CXXBindTemporaryExpr we mark the CXXBindTemporaryExpr as
executed in the state; when we reach a branch that contains the
corresponding CXXBindTemporaryExpr as terminator, we branch out
depending on whether the corresponding CXXBindTemporaryExpr was marked
as executed.

llvm-svn: 214962
2014-08-06 12:45:51 +00:00
Manuel Klimek b0042c414e Fix some cases of incorrect handling of lifetime extended temporaries.
MaterializeTemporaryExpr already contains information about the lifetime
of the temporary; if the lifetime is not the full statement, we do not
want to emit a destructor at the end of the full statement for it.

llvm-svn: 214292
2014-07-30 08:34:42 +00:00
Richard Smith 4137af286f When looking for temporary dtors while building the CFG, do not walk into
lambda expressions (other than their capture initializers) nor blocks. Do walk
into default argument expressions and default initializer expressions.

These bugs were causing us to produce broken CFGs whenever a lambda expression
was used to initialize a libstdc++ std::function object!

llvm-svn: 214050
2014-07-27 05:12:49 +00:00
Anna Zaks a6fea1386f Fix a crash in Retain Count checker error reporting
Fixes a crash in Retain Count checker error reporting logic by handing
the allocation statement retrieval from a BlockEdge program point.

Also added a simple CFG dump routine for debugging.

llvm-svn: 210960
2014-06-13 23:47:38 +00:00
Richard Trieu ddd01cec0e Removing an "if (this == nullptr)" check from two print methods. The condition
will never be true in a well-defined context.  The checking for null pointers
has been moved into the caller logic so it does not rely on undefined behavior.

llvm-svn: 210498
2014-06-09 22:53:25 +00:00
Jordan Rose 7afd71e4ff Add a check for tautological bitwise comparisons to -Wtautological-compare.
This catches issues like:

if ((x & 8) == 4) { ... }
if ((x | 4) != 3) { ... }

Patch by Anders Rönnholm!

llvm-svn: 209221
2014-05-20 17:31:11 +00:00
Craig Topper 2554294321 [C++11] Use 'nullptr'. Analysis edition.
llvm-svn: 209191
2014-05-20 04:30:07 +00:00
Manuel Klimek 75f34c1386 Fix handling of condition variables in the face of temp dtors.
The assignment needs to be before the destruction of the temporary.
This patch calls out to addStmt, which invokes VisitDeclStmt, which has
all the correct logic for handling temporaries.

llvm-svn: 207985
2014-05-05 18:21:06 +00:00
Richard Trieu f935b562b9 Add a new subgroup to -Wtautological-compare, -Wtautological-overlap-compare,
which warns on compound conditionals that always evaluate to the same value.
For instance, (x > 5 && x < 3) will always be false since no value for x can
satisfy both conditions.

This patch also changes the CFG to use these tautological values for better
branch analysis.  The test for -Wunreachable-code shows how this change catches
additional dead code.

Patch by Anders Rönnholm.

llvm-svn: 205665
2014-04-05 05:17:01 +00:00
Jordan Rose 398fb00e1e [analyzer] Fix a CFG printing bug.
Also, add several destructor-related tests. Most of them don't work yet, but it's
good to have them recorded.

Patch by Alex McCarthy!

llvm-svn: 205326
2014-04-01 16:39:33 +00:00
Ted Kremenek ec3bbf4933 Improve -Wunreachable-code to provide a means to indicate code is intentionally marked dead via if((0)).
Taking a hint from -Wparentheses, use an extra '()' as a sigil that
a dead condition is intentionally dead.  For example:

  if ((0)) { dead }

When this sigil is found, do not emit a dead code warning.  When the
analysis sees:

  if (0)

it suggests inserting '()' as a Fix-It.

llvm-svn: 205069
2014-03-29 00:35:20 +00:00
Aaron Ballman c7e4e219b5 [C++11] Replacing CompoundStmt iterators body_begin() and body_end() with iterator_range body(). Updating all of the usages of the iterators with range-based for loops.
llvm-svn: 204040
2014-03-17 14:19:37 +00:00